REMARKS 

Claims 1-24 remain pending in the above-identified patent application. In 
response to the Office Action mailed on June 28, 2007, Applicants respectfully 
request the Examiner to enter the aforementioned amendments and consider the 
following remarks for allowance of the above-identified patent application. In 
particular, Claims 2, 4, 7, 9 and 12-23 are amended herein. No new matter has 
been added as a result of these amendments. 

Moreover, Applications respectfully point out that the clerical error in the 
previous amendment to Claim 4, as referenced in the instant Notice of Non- 
Compliance, has been corrected herein. Applicants wish to thank the Examiner 
for bringing this clerical error to Applicants' attention. 

CLAIM REJECTIONS - 35 U.S.C. 3 1 1 2 
Claims 2 and 21 are rejected under 35 U.S.C. § 112, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention in view of the term 
"substantially" which appears in the claims. In so much as the term 
"substantially" has been deleted from Claims 2 and 21 , Applicants respectfully 
submit that the rejections of Claims 2 and 21 under 35 U.S.C. § 1 12, second 
paragraph, are moot at this time. 
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CLAIM REJECTIONS - 35 U.S.C. 5 101 
Claims 20-22 are rejected under 35 U.S.C. § 101 as being directed to non- 
statutory subject matter since Claims 20-22 comprise a data structure. In so 
much as Claims 20-22 have been amended to comprise instructions on a 
computer-usable medium used to carry out a useful result (i.e., establishing a 
consistent password policy), Applicants respectfully submit that the rejections of 
Claims 20-22 under 35 U.S.C. § 101 are moot at this time. 

CLAIM REJECTIONS - 35 U.S.C. § 102(e) 
Claims 1 , 3, 4, 20, 23 and 24 are rejected under 35 U.S.C. § 102(e) as 
being anticipated by Resnitzky et al. (Publication No. US 2004/0068650). 
Applicants have reviewed the above cited reference and respectfully submit that 
the embodiments of the present invention as recited in Claims 1 , 3, 4, 20, 23 and 
24 are not anticipated by Resnitzky for at least the following rationale. 

Independent Claim 1 , and similarly independent Claims 20 and 23 as 
amended, recites the features: 

A method of establishing a consistent password policy, said method 
comprising: 

describing a plurality of password policies in a computer usable 
password policy data structure; 

accessing said computer usable password policy data structure by 
a password policy enforcement agent; and 

enforcing at least one of said plurality of password policies 
described within said password policy data structure by said password 
policy enforcement agent. 
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"[A]nticipation requires the presence in a single prior art reference 
disclosure of each and every element of the claimed invention, arranged as in the 
claim Lindemann Maschinefabrik GmbH v. American Hoist & Derrick Co., 
221 USPQ 481, 485 (Fed. Cir. 1984) (emphasis added). 

MPEP§2131 provides: 

"A claim is anticipated only if each and every element as set forth in the 
claim is found, either expressly or inherently described, in a single prior art 
reference." Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). ... "The identical invention 
must be shown in as complete detail as is contained in the ... claim." 
Richardson v. Suzuki Motor Co., 868 F.2d 1226, 1236, 9 USPQ2d 1913, 
1920 (Fed. Cir. 1989). The elements must be arranged as required by 
the claim. 



Applicants respectfully submit that Resnitzky fails to disclose each and 
every element of Claim 1 , arranged as in the claim. Applicants understand 
Resnitzky to teach: 

the server component 20 can store authentication information for each 
user in the database (such as a user password hash), and then the 
user will be prompted for the password after establishment of the TLS 
session. In this case the management console 30 will include the features 
needed to administer the user database including: user creation, user 
deletion, user password reset, defining password policy. The server 
component 20 will enforce the password policy .... 

Resnitzky, page 6, paragraph [0111] (emphasis added). Applicants do not 
understand Resnitzky to anticipate, for example, describing a plurality of 
password policies in a computer usable password policy data structure - 
accessing said computer usable password policy data structure bv a password 
policy enforcement agent , and enforcing at least one of said plurality of password 
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policies described wit hin said password policy data structure bv said password 
policy enforcement aaent . as claimed. 

As stated above, Applicants understand Resnitzky to teach "the server 
component ... can store authentication information ... such as a user 
password hash." See Resnitzky, page 6, paragraph [01 1 1] (emphasis added). 
Applicants further understand Resnitzky to teach that "[t]he server component ... 
will enforce the password policy See Id. However, Applicants do not 
understand storing authentication information, such as a user password hash, or 
enforcing "the password policy" to anticipate, for example, describing a plurality 
of password policies in a computer usable password policy data structure, and 
enforcing at least one of the plurality of password policies described within 
the password policy data structure by a password policy enforcement agent, as 
claimed. 

For at least the foregoing rationale, Applicants respectfully submit that 
Claim 1 , and similarly Claims 20 and 23 as amended, is not anticipated by 
Resnitzky under 35 U.S.C. §1 02(e). As such, allowance of Claims 1, 20 and 23 
is respectfully requested. 

With respect to Claims 3 and 4, Applicants respectfully point out that 
Claims 3 and 4 depend from allowable amended independent Claim 1 , and recite 
further features of the present claimed invention. With respect to Claim 24, 
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Applicants respectfully point out that Claim 24 depends from allowable amended 
independent Claim 23, and recites further features of the present claimed 
invention. Therefore, Applicants respectfully submit that Claims 3, 4 and 24 
overcome the rejections under 35 U.S.C. §1 02(e), and that these claims are thus 
in a condition for allowance as being dependent on an allowable base claim. As 
such, allowance of Claims 3, 4 and 24 is respectfully requested. 
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CLAIM REJECTIONS - 35 U.S.C. § 103(a) 



I. Claims 2, 19 and 21 

Claims 2, 19 and 21 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Resnitzky in view of Cole et al. (Publication No. US 
2002/0161707). Applicants have reviewed the above cited references and 
respectfully submit that the embodiments of the present invention as recited in 
Claims 2, 19 and 21 are patentable over the cited references for at least the 
following rationale. 



Independent Claim 1 , and similarly independent Claims 20 and 23 as 
amended, recites the features: 

A method of establishing a consistent password policy, said method 
comprising: 

describing a plurality of password policies in a computer usable 
password policy data structure; 

accessing said computer usable password policy data structure by 
a password policy enforcement agent; and 

enforcing at least one of said plurality of password policies 
described within said password policy data structure by said password 
policy enforcement agent. 



To establish prima facie obviousness of a claimed invention, all the claim 
limitations must be taught or suggested by the prior art. In re Royka, 490 F.2d 
981, 180 USPQ 580 (CCPA 1974). (MPEP 2143.03). 

Similarly, MPEP §2143 provides: 

To establish a prima facie case of obviousness ... the prior art reference 
(or references when combined) must teach or suggest all the claim 
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limitations. 



Applicants respectfully submit that Resnitzky in view of Cole fails to teach 
or suggest each and every element of Claim 1 , and similarly Claims 20 and 23 as 
amended. Applicants understand Resnitzky to teach a method for secured data 
processing wherein "[t]he server component ... will enforce the password 
policy Resnitzky, page 6, paragraph [0111] (emphasis added). 

Applicants understand Cole to teach a method and system for multi- 
currency escrow service for web-based transactions wherein "[t]he user ID and 
password must comply with a predefined user ID and password policy of the 
system." Cole, page 9, paragraph [0095] (emphasis added). Applicants further 
understand Cole to teach "[t]he password assigned by the user and the 
subsequent maintenance of passwords are governed by a predefined 
password policy, including data driven key password policy parameters." Cole, 
page 9, paragraph [0102] (emphasis added). 

Applicants do not understand the combination of Resnitzky and Cole to 
teach or suggest describing a plurality of password policies in a computer usable 
password policy data structure , accessing said computer usable password policy 
data structure by a password policy enforcement agent , and enforcing at least 
one of said plurality of password policies described within said password policy 
data structure by said password policy enforcement agent , as claimed. 
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For instance, Applicants do not understand "[t]he user ID and password 
must comply with a predefined user ID and password policy of the system" to 
teach or suggest describing a plurality of password policies in a computer 
usable password policy data structure and accessing said computer usable 
password policy data structure by a password policy enforcement agent. 
Moreover, Applicants do not understand "[t]he password assigned by the user 
and the subsequent maintenance of passwords are governed by a predefined 
password policy, including data driven key password policy parameters" to 
teach or suggest describing a plurality of password policies in a computer 
usable password policy data structure and accessing said computer usable 
password policy data structure by a password policy enforcement agent. 

For at least the foregoing rationale, Applicants respectfully submit that 
Claim 1, and similarly Claims 20 and 23 as amended, are not unpatentable over 
Resnitzky in view of Cole under 35 U.S.C. §1 03(a). As such, allowance of 
Claims 1 , 20 and 23 is respectfully requested. 

With respect to Claims 2, 19 and 21 , Applicants respectfully point out that 
Claims 2 and 19 depend from allowable amended independent Claim 1, and 
recite further features of the present claimed invention. With respect to Claim 21 , 
Applicants respectfully point out that Claim 21 depends from allowable amended 
independent Claim 20, and recites further features of the present claimed 
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invention. Therefore, Applicants respectfully submit that Claims 2, 19 and 21 
overcome the rejections under 35 U.S.C. §1 03(a), and that these claims are thus 
in a condition for allowance as being dependent on an allowable base claim. As 
such, allowance of Claims 2, 19 and 21 is respectfully requested. 

II. Claims 5-18 and 22 

Claims 5-18 and 22 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Resnitzky in view of Password Policy of eRA (hereinafter 
"Password Policy"). Applicants have reviewed the above cited references and 
respectfully submit that the embodiments of the present invention as recited in 
Claims 5-18 and 22 are patentable over the cited references for at least the 
following rationale. 

Applicants respectfully submit that Resnitzky in view of Password Policy 
fails to teach or suggest each and every element of Claim 1 , and similarly Claims 
20 and 23 as amended. As stated above, Applicants understand Resnitzky to 
teach a method for secured data processing wherein "[t]he server component ... 
will enforce the password policy Resnitzky, page 6, paragraph [0111] 
(emphasis added). 

Applicants understand Password Policy to teach a password policy for 
eRA. Applicants further understand Password Policy to teach "[t]his policy 
addresses the risk of weak passwords as well as password disclosure - 



200300497-1 

Examiner: Hoffman, Brandon S. 



- 17- 



Serial No.: 10/723,119 
Group Art Unit: 2136 



intentional or unintentional, malicious or benign - and hence, unauthorized 
access to servers and data." Password Policy, page 1 , section 1 .0 (emphasis 
added). Applicants further understand Password Policy to teach "[a]ll servers 
have the Operating System configured to enforce this policy and 
"[mjanagement ensures the uniform enforcement of this policy." See 
Password Policy, page 5, sections 7.0 - 8.0 (emphasis added). 

Applicants do not understand the combination of Resnitzky and Password 
Policy to teach or suggest describing a plurality of password policies in a 
computer usable password policy data structure , accessing said computer usable 
password policy data structure bv a password policy enforcement agent , and 
enforcing at least one of said plurality of password policies described within said 
password policy data structure bv said password policy enforcement agent , as 
claimed. 

For instance, Applicants do not understand a password policy for eRA, or 
the uniform enforcement of this policy, to teach or suggest describing a 
plurality of password policies in a computer usable password policy data 
structure and accessing said computer usable password policy data structure by 
a password policy enforcement agent. 

For at least the foregoing rationale, Applicants respectfully submit that 
Claim 1, and similarly Claims 20 and 23 as amended, are not unpatentable over 
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Resnitzky in view of Password Policy under 35 U.S.C. §1 03(a). As such, 
allowance of Claims 1 , 20 and 23 is respectfully requested. 

With respect to Claims 5-18 and 22, Applicants respectfully point out that 
Claims 5-18 depend from allowable amended independent Claim 1, and recite 
further features of the present claimed invention. With respect to Claim 22, 
Applicants respectfully point out that Claim 22 depends from allowable amended 
independent Claim 20, and recites further features of the present claimed 
invention. Therefore, Applicants respectfully submit that Claims 5-18 and 22 
overcome the rejections under 35 U.S.C. §1 03(a), and that these claims are thus 
in a condition for allowance as being dependent on an allowable base claim. As 
such, allowance of Claims 5-18 and 22 is respectfully requested. 
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CONCLUSION 



In light of the above listed remarks, reconsideration of the rejected claims 
is requested. Based on the amendments and arguments presented above, it is 
respectfully submitted that Claims 1-24 overcome the rejections of record. 
Therefore, allowance of Claims 1-24 is respectfully solicited. 

Should the Examiner have a question regarding the instant amendment 
and response, the Applicants invite the Examiner to contact the Applicants' 
undersigned representative at the below listed telephone number. 



Respectfully submitted, 
Wagner Blecher LLP 



Date: 1/18/2008 




John P. Wagner, Jr. 
Reg. No. 35,398 



WESTRIDGE BUSINESS PARK 
123 WESTRIDGE DRIVE 
WATSONVILLE, CALIFORNIA 95076 
(408) 377-0500 



200300497-1 

Examiner: Hoffman, Brandon S. 



20- 



Serial No.: 10/723,119 
Group Art Unit: 2136 



